Multiple Eventcodes in same Blacklist

[helpmelearn]

Hello 

We are trying to change the below blacklists: 

blacklist3 = EventCode="4690" 
blacklist4 = EventCode="5145"
blacklist5 = EventCode="5156"
blacklist6 = EventCode="4658"
blacklist7 = EventCode="5158"

To a single blacklist with multiple eventcodes. We have tried:

blacklist3 = EventCode=5145,5156,4658,4690,5158

and

blacklist3 = EventCode="5145" OR "5156" OR "4658" OR "4690" OR "5158"

And none of these are applying and blocking out the event codes. 

Any recommendations on how to get this to work? 

[richgalloway · Accepted solution]

The syntax is incorrect.  A blacklist must be a comma-separated list of event IDs or pairs of key=regex specifiers.  Try this

blacklist3 = 5145,5156,4658,4690,5158

[helpmelearn]

Thankyou! This worked 😄